Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort 2.9.4.6 Pkg v 2.5.9

    Scheduled Pinned Locked Moved pfSense Packages
    203 Posts 28 Posters 110.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      shinzo
      last edited by

      I made the correction.  I will see in the morning after the update if it crashes again.  Its most likely because i am running the current_events rule.  Most of those are off except for the dns ampliication.  Every time it updates, it usually adds a new rule in there which is enabled by default.

      1 Reply Last reply Reply Quote 0
      • M
        masli
        last edited by

        The new Snort , is working well. However , there is small issue which is the snort interface did not auto start after system restart I have to restart it manually. Any advice?

        1 Reply Last reply Reply Quote 0
        • T
          traxxus
          last edited by

          Check the System Log what's going on.

          1 Reply Last reply Reply Quote 0
          • bmeeksB
            bmeeks
            last edited by

            @masli:

            The new Snort , is working well. However , there is small issue which is the snort interface did not auto start after system restart I have to restart it manually. Any advice?

            If you have more than one Snort-enabled interface and are running a large rule set, it can take Snort up to a couple of minutes to get cranked up on all the interfaces.  So depending on how quickly you navigate to the Snort Interfaces tab after startup, you may find an interface still showing the red "stopped" icon.  But if you go view the System Log you should see some evidence of the interfaces coming up.  Eventually, if you refresh the Snort Interfaces tab a time or two, the icons should all be green (for running).

            If not, then as suggested by others, check the System Log to see if any messages printed there will give a clue.

            Bill

            1 Reply Last reply Reply Quote 0
            • C
              cjbujold
              last edited by

              Follow-up to the last post, If you wait the icons do turn green for snort, however the barnyard icon never turns green in my case.  When I look at the log Barnyard seems to be started but this is not shown on the screen.  Is Barnyard really working???? How can I verify if it is working?

              Jul 1 10:02:01 SnortStartup[43369]: Snort START for Accra -Snort(2472_em0)…
              Jul 1 10:02:01 check_reload_status: Syncing firewall
              Jul 1 10:02:02 check_reload_status: Reloading filter
              Jul 1 10:03:38 kernel: em0: promiscuous mode enabled
              Jul 1 10:03:42 SnortStartup[17594]: Barnyard2 START for Accra -Snort(2472_em0)…

              Thanks

              cjb

              ![2013-07-01 10-07-24 AM.png](/public/imported_attachments/1/2013-07-01 10-07-24 AM.png)
              ![2013-07-01 10-07-24 AM.png_thumb](/public/imported_attachments/1/2013-07-01 10-07-24 AM.png_thumb)

              1 Reply Last reply Reply Quote 0
              • bmeeksB
                bmeeks
                last edited by

                @cjbujold:

                Follow-up to the last post, If you wait the icons do turn green for snort, however the barnyard icon never turns green in my case.  When I look at the log Barnyard seems to be started but this is not shown on the screen.  Is Barnyard really working???? How can I verify if it is working?

                Jul 1 10:02:01 SnortStartup[43369]: Snort START for Accra -Snort(2472_em0)…
                Jul 1 10:02:01 check_reload_status: Syncing firewall
                Jul 1 10:02:02 check_reload_status: Reloading filter
                Jul 1 10:03:38 kernel: em0: promiscuous mode enabled
                Jul 1 10:03:42 SnortStartup[17594]: Barnyard2 START for Accra -Snort(2472_em0)…

                Thanks

                cjb

                One way is from the console.  Issue this command and see if a barnyard2 process shows up –

                ps -ax |grep barnyard2
                

                Barnyard2 on my system is very noisy (as in logs lots of semi-useless startup messages).  If it is actually starting, you should see a number of system log messages.

                Make sure your database credentials are correctly set and that it can connect to the MySQL database.  From the console on the firewall, grep the system log for any barnyard2 messages as follows:

                grep barnyard /var/log/system.log
                

                Post back any pertinent findings or clues.  Could be a shared library issue where something stepped on a library barnyard2 needs.  Is this a 2.0.x or 2.1 pfSense box?

                Bill

                1 Reply Last reply Reply Quote 0
                • S
                  shinzo
                  last edited by

                  So it updated and it didnt crash.  I can only assume that line was the issue.  Thanks for the help

                  1 Reply Last reply Reply Quote 0
                  • C
                    cjbujold
                    last edited by

                    Bill,

                    I am using PFSense 2.0.3-RELEASE (amd64)

                    Here is what I receive when I check for Barnyard

                    $ ps -ax |grep barnyard2
                    34971  ??  S      0:00.00 sh -c ps -ax |grep barnyard2
                    35558  ??  S      0:00.00 grep barnyard2

                    $ grep barnyard /var/log/system.log
                    Jul  1 08:37:15 protector php: /snort/snort_interfaces.php: Toggle (barnyard starting) for WAN(Accra -Snort)…
                    Jul  1 08:40:44 protector php: /snort/snort_interfaces.php: Toggle (barnyard starting) for WAN(Accra -Snort)...
                    Jul  1 08:52:14 protector php: /snort/snort_interfaces.php: Toggle (barnyard starting) for WAN(Accra -Snort)...

                    Thanks for the help

                    cjb

                    1 Reply Last reply Reply Quote 0
                    • bmeeksB
                      bmeeks
                      last edited by

                      @shinzo:

                      So it updated and it didnt crash.  I can only assume that line was the issue.  Thanks for the help

                      Thanks for the feedback.  I've fixed that line in my source code repository.  I have that one and another small fix I will submit in the near future, but won't bump the package version number so it won't show as a new package update.

                      I am making good progress on the multi-engine configurations.  I'm finished with HTTP_INSPECT, FRAG3 and STREAM5.  Also saw Snort 2.9.5 was posted yesterday by the Snort.org guys.  Will most likely wait and release the new multi-engine Snort with an update to the 2.9.5 binary, but need to wait until the 2.9.5 rules are available for the registered, free users at Snort.org.  Don't want to repeat the mistake of last time when the binary got updated ahead of the new rules being available for the registered  users (the subscriber users always get the latest rules immediately).

                      Bill

                      1 Reply Last reply Reply Quote 0
                      • bmeeksB
                        bmeeks
                        last edited by

                        @cjbujold:

                        Bill,

                        I am using PFSense 2.0.3-RELEASE (amd64)

                        Here is what I receive when I check for Barnyard

                        $ ps -ax |grep barnyard2
                        34971  ??  S      0:00.00 sh -c ps -ax |grep barnyard2
                        35558  ??  S      0:00.00 grep barnyard2

                        $ grep barnyard /var/log/system.log
                        Jul  1 08:37:15 protector php: /snort/snort_interfaces.php: Toggle (barnyard starting) for WAN(Accra -Snort)…
                        Jul  1 08:40:44 protector php: /snort/snort_interfaces.php: Toggle (barnyard starting) for WAN(Accra -Snort)...
                        Jul  1 08:52:14 protector php: /snort/snort_interfaces.php: Toggle (barnyard starting) for WAN(Accra -Snort)...

                        Thanks for the help

                        cjb

                        OK, your barnyard2 instance is not starting up. It's trying, but then dies badly since there is no further logging.  My first guess is that something (another package perhaps) has stepped on a shared library.  Try removing (deleting) and reinstalling Snort to see if that helps.  Just click the "save settings on deinstall" checkbox on the Global Settings tab first, and you won't lose your Snort configuration.  It's possible, though, that the Snort remove and reinstall still won't fix the shared library if it's marked as "in use" by another package.

                        If that does not work (or you have already tried it), then we need to try starting barnyard2 from the command line to see if it will give us some clues.  From a console prompt just type "barnyard2" and ENTER.  If it makes it far enough into starting, it will fuss about no configuration file.  However, I'm going to guess it barfs first with a missing or wrong version library.  Post back with the results.

                        Bill

                        P.S. – I don't remember the details, but seems like another user had barnyard2 troubles a while back that were traced to a shared library conflict.  You might try a search on the Forum to see if you find it.  It was maybe 2 or 3 months back (definitely from this year, though).

                        1 Reply Last reply Reply Quote 0
                        • S
                          shinzo
                          last edited by

                          I am making good progress on the multi-engine configurations.  I'm finished with HTTP_INSPECT, FRAG3 and STREAM5.  Also saw Snort 2.9.5 was posted yesterday by the Snort.org guys.  Will most likely wait and release the new multi-engine Snort with an update to the 2.9.5 binary, but need to wait until the 2.9.5 rules are available for the registered, free users at Snort.org.  Don't want to repeat the mistake of last time when the binary got updated ahead of the new rules being available for the registered  users (the subscriber users always get the latest rules immediately).

                          Bill

                          Good to hear that they are finished.  Can you post screenshots of how they are going to look?. Yes it would be best to hold out on the update until everyone is able to get the rules.  The snort manual got updated too which is nice also.  Anyway thanks again.

                          1 Reply Last reply Reply Quote 0
                          • C
                            cjbujold
                            last edited by

                            barnyard problem update

                            Tried removing and re-installing package same error the error is:

                            /libexec/ld-elf.so.1: Shared object "libmysqlclient.so.18" not found required by "barnyard2".

                            How can I install it,  since a re-install does not do the trick.

                            Thanks for the help

                            cjb

                            1 Reply Last reply Reply Quote 0
                            • F
                              fragged
                              last edited by

                              It's a problem with the 2.0.X package manager system. With 2.1's PBI's things usually remove and install in a more sane way. With 2.0.X packages might share some of the additional components and things might break because of that.

                              1 Reply Last reply Reply Quote 0
                              • bmeeksB
                                bmeeks
                                last edited by

                                @fragged:

                                It's a problem with the 2.0.X package manager system. With 2.1's PBI's things usually remove and install in a more sane way. With 2.0.X packages might share some of the additional components and things might break because of that.

                                fragged is correct.  On the 2.0.x platform, libraries such as MySQL and others are shared among applications.  It's a condition not all that unlike the "DLL Hell" that existed in Windows where different versions of the same DLL stored in different places caused all kinds of grief.

                                The 2.1 platform with PBI sort of puts each application and all of its "shared libraries" into a type of "jail" where they appear to be shared for the application, but really aren't.  Each app has its own copy of the libraries in a dedicated directory tree isolated from other apps.

                                First up, run this command on the console to see what version of MySQL is actually installed on your box:

                                pkg_info | grep mysql
                                

                                It should come back and say mysql-client-5.5.30.  My guess is yours will come back with something different.  If it does, then run this command to see what installed the version you have (the backslashes and asterisks are required and act as wildcards):

                                pkg_info \*mysql*\
                                

                                Look for the "Required by:" line.  That will show what other package might be using MySQL on your box.  Again, the correct response there would be:

                                Required by:
                                barnyard2-1.12
                                

                                Run the commands above and post back one more time.  You can also check out this post from jimp showing the best way to fix these shared library issues on 2.0.x:  http://forum.pfsense.org/index.php/topic,63253.msg342512.html#msg342512

                                Bill

                                1 Reply Last reply Reply Quote 0
                                • C
                                  cjbujold
                                  last edited by

                                  barnyard issue:

                                  Ran the first command and got back the following:

                                  mysql-client-5.1.53-multitreaded sql database(client)
                                  mysql-client-5.1.57-multitreaded sql database(client)
                                  mysql-client-5.5.29-multitreaded sql database(client)
                                  mysql-client-5.6.30-multitreaded sql database(client)

                                  Ran the second command and got back:

                                  pkg_info: No match

                                  Then removed snort again and ran from the shell the command:

                                  pkg_delete -f *snort* *barny* *mysql*

                                  Re-installed snort

                                  and Now I receive the following error in the log and barnyard does not start

                                  Jul 4 10:29:05 barnyard2[8071]: Writing PID "8071" to file "/var/run/barnyard2_em02472.pid"
                                  Jul 4 10:29:05 barnyard2[8071]: FATAL ERROR: database mysql_error: Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2)
                                  Jul 4 10:29:05 barnyard2[8071]: FATAL ERROR: database mysql_error: Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2)

                                  This is the setting for MYSQL in Snort for barnyard

                                  output database: alert, mysql, dbname=snort user=snort host=localhost password=xyz

                                  When I re-run the first command I now get:

                                  mysql-client-5.5.30-multitreaded sql database(client)  -  This is good!!!

                                  The second command still comes with  "No Match"  - Not so GOOD!!!

                                  Any suggestions on how to fix?  Thanks

                                  cjb

                                  1 Reply Last reply Reply Quote 0
                                  • bmeeksB
                                    bmeeks
                                    last edited by

                                    @cjbujold:

                                    barnyard issue:

                                    Ran the first command and got back the following:

                                    mysql-client-5.1.53-multitreaded sql database(client)
                                    mysql-client-5.1.57-multitreaded sql database(client)
                                    mysql-client-5.5.29-multitreaded sql database(client)
                                    mysql-client-5.6.30-multitreaded sql database(client)

                                    Ran the second command and got back:

                                    pkg_info: No match

                                    Then removed snort again and ran from the shell the command:

                                    pkg_delete -f *snort* *barny* *mysql*

                                    Re-installed snort

                                    and Now I receive the following error in the log and barnyard does not start

                                    Jul 4 10:29:05 barnyard2[8071]: Writing PID "8071" to file "/var/run/barnyard2_em02472.pid"
                                    Jul 4 10:29:05 barnyard2[8071]: FATAL ERROR: database mysql_error: Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2)
                                    Jul 4 10:29:05 barnyard2[8071]: FATAL ERROR: database mysql_error: Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2)

                                    This is the setting for MYSQL in Snort for barnyard

                                    output database: alert, mysql, dbname=snort user=snort host=localhost password=xyz

                                    When I re-run the first command I now get:

                                    mysql-client-5.5.30-multitreaded sql database(client)  -  This is good!!!

                                    The second command still comes with  "No Match"   - Not so GOOD!!!

                                    Any suggestions on how to fix?  Thanks

                                    cjb

                                    My mistake on the second command.  I pasted in the backslash and asterisk backwards.  It should be this way:

                                    pkg_info \*mysql\*
                                    

                                    Yes, having the myslq-client-5.5.30 is good.  That is the correct version.

                                    Are you trying to have the MySQL database on the firewall?  If so, then you would need to manually install MySQL Server.  That's not recommended.  When using Barnyard2, you should have a remote MySQL install on a separate database server.  The Barnyard2 setup in Snort is simply a client that needs the MySQL client to communicate with a remote database.

                                    From your database string, it appears you are trying to connect to a local MySQL instance:  host=localhost

                                    There won't be one unless you jump through hoops and install the full MySQL database server on the firewall.  What you should do is install MySQL server on a separate box (physical or VM), configure the database for Snort, then put that database server name in the database string in Barnyard2.

                                    I run Snorby on a separate virtual machine.  I have MySQL Server installed on that VM, and my Barnyard2 database connect string points there.  Unless you use a third-party tool like Snorby or others like it, there is no real benefit to logging via Barnyard2 with MySQL.

                                    Bill

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      Syntax42
                                      last edited by

                                      I just updated Snort to package version 2.5.9 on my machine which is running 2.1-RC0.

                                      I'm not sure if this bug is known or not, and I didn't see it in the thread.

                                      With the new installation of the Snort package, I created a new, empty suppress list.  Afterwards, clicking the suppress button in the alerts tab under the SID column did not work as expected.  No suppression entry was generated in the suppression list and the line in the alert was not 'greyed out' to indicate the rule was being suppressed.

                                      As a workaround, I manually created one suppression rule by copying and pasting a rule from the example on the suppression page and saved.  Automatic suppression generation buttons worked fine after that.

                                      1 Reply Last reply Reply Quote 0
                                      • bmeeksB
                                        bmeeks
                                        last edited by

                                        @Syntax42:

                                        I just updated Snort to package version 2.5.9 on my machine which is running 2.1-RC0.

                                        I'm not sure if this bug is known or not, and I didn't see it in the thread.

                                        With the new installation of the Snort package, I created a new, empty suppress list.  Afterwards, clicking the suppress button in the alerts tab under the SID column did not work as expected.  No suppression entry was generated in the suppression list and the line in the alert was not 'greyed out' to indicate the rule was being suppressed.

                                        As a workaround, I manually created one suppression rule by copying and pasting a rule from the example on the suppression page and saved.  Automatic suppression generation buttons worked fine after that.

                                        Thanks for the report.  I will check it out in my VM test environment and attempt to reproduce.  Just to be sure I have the correct initial conditions:

                                        – you created an empty but named Suppress List and then assigned that list to the Snort interface.
                                        -- next, you clicked on an Alert entry on the Alerts tab to auto-add the event to the Suppress List, but it did not work.
                                        -- you then created an entry manually in the same Suppress List, and then auto-additions worked.

                                        Did I get the sequence correct?

                                        Bill

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          adam65535
                                          last edited by

                                          I remember seeing similar behavior and I am pretty sure it was with a blank whitelist too.  I ended up editing the whitelist manually for some reason and at some point I noticed it was working again.

                                          1 Reply Last reply Reply Quote 0
                                          • bmeeksB
                                            bmeeks
                                            last edited by

                                            @Syntax42:

                                            I just updated Snort to package version 2.5.9 on my machine which is running 2.1-RC0.

                                            I'm not sure if this bug is known or not, and I didn't see it in the thread.

                                            With the new installation of the Snort package, I created a new, empty suppress list.  Afterwards, clicking the suppress button in the alerts tab under the SID column did not work as expected.  No suppression entry was generated in the suppression list and the line in the alert was not 'greyed out' to indicate the rule was being suppressed.

                                            As a workaround, I manually created one suppression rule by copying and pasting a rule from the example on the suppression page and saved.  Automatic suppression generation buttons worked fine after that.

                                            @adam65535:

                                            I remember seeing similar behavior and I am pretty sure it was with a blank whitelist too.  I ended up editing the whitelist manually for some reason and at some point I noticed it was working again.

                                            I found this bug.  The fix will be in the next Snort Package update.  The code I wrote blindly assumed any pre-existing Suppress List would not initially be "empty".  That was a dumb assumption on my part.  Should have thought about the scenario described here.  I was testing for a "if not empty" list and updating it with the new entry, but if the list was empty my code was just falling through the "if statement" and doing nothing.

                                            Sorry about that… :(
                                            Bill

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.